Identify (ID) · Authorization
Authorization at the discovered layer
·
What agents exist, what they touch, what threats they face?
What this cell does
K8s RBAC API list, AWS IAM Access Analyzer effective permissions, Kyverno PolicyReports of policies actually applied.
Cell notes
Inventory, Authorization / Discovered
What this cell records. The runtime-effective permissions, regardless of declared scope.
Sources
- -
kubectl auth can-i --list --as=system:serviceaccount:agent-X:claude-codefor every agent SA. - -
aws accessanalyzer list-findingsfor unused permissions per principal. - -
kubectl get policyreports -Afor which Kyverno policies are actually applying to which agents.
Cross-layer
Discovered effective permissions > operator-declared scope = scope creep. Audit and either tighten or amend the charter.
Citation
NIST CSF 2.0 ID.RA-09, ID.RA-01. NIST AI RMF MAP 5.1. NIST SP 800-207.
Crosswalk
| NIST CSF 2 0 | ID.RA-09, ID.RA-01 |
|---|---|
| NIST AI RMF | MAP 5.1 |
| CSA MAESTRO | Layer 4, Layer 6 |
| OTHER | NIST SP 800-207 |
Cite this cell:
https://agenticcovenants.com/identify/authorization/discovered/